Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /f /im Tu.exe
- '<SYSTEM32>\taskkill.exe' /f /im UninstallTool.exe
Modifies file system:
Creates the following files:
- %TEMP%\is-B2FOE.tmp\<File name>.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-CJUQC.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-M5SO6.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-6FL00.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-PPRSQ.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-18UKQ.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-9P1MS.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-5O8T4.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-6HCK1.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-8T38F.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-E3D47.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-A35JJ.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-TU0JH.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-4H8QI.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-I5SKE.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-OGLQL.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-V4UPH.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-NPF4C.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-9NKVP.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-RKOTH.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-2EI8A.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-4J3J4.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-V442H.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-L9SRF.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-E8B83.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-IMS63.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-T5PJJ.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-KEPOU.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\trashtime.dat
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\calendar\kcalendarsetting.ini
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\bdmisc.dat
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\rcmdlocal.dat
- %TEMP%\is-MIF4Q.tmp\kcleaner\ktrashud.dat
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\clearplugin\ksreng3.dll
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\kclearak.dat.d
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\kxesetting.dat
- %TEMP%\is-MIF4Q.tmp\kcleaner\switch.dat
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\bootoptcfg.ini
- %TEMP%\is-MIF4Q.tmp\kcleaner\kxetray.log
- %APPDATA%\kingsoft\is-2J8JN.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\clearplugin\is-ONPEU.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\security\kxescan\is-88F1I.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\security\kxescan\is-KT6PP.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\security\kxescan\is-T0D5F.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-C7M42.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-DCRM7.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-6OJ03.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-OR79N.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-N87ON.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-EOH25.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-5N17T.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-KQ5NT.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-JI2SU.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-VOO7O.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-GF5T5.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-HJG94.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-BN5RP.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-253M3.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-DNBNH.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-I62F9.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-8D9KS.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\is-T9RTR.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\is-2LCS3.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\is-PKATJ.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\is-GVJCB.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\is-6R21H.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\is-CHB31.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\is-P2NLQ.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\is-HA2IE.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\is-OT0SJ.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\is-3U5RM.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\is-USTBI.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\is-SF3LP.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\is-M4DT2.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\is-LN75V.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\is-0OTBQ.tmp
- %TEMP%\is-GBHIO.tmp\<File name>.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-N2P70.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-N6I7S.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-15SD2.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-H148J.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-UGCOG.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-5GEPF.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-63NJ7.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-T549J.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-B0IRN.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-ESQDJ.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-1VNDK.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-RFMS9.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-3VIK2.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-13S4M.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-SJ8OE.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-RSSF2.tmp
- %APPDATA%\kingsoft\is-LP26R.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\kclearusecfg.dat
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\clearplugin\is-JT53T.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\clearplugin\is-JGI55.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\calendar\is-UTHF1.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-GR3HL.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-5HR48.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-4EVLQ.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-5SEA6.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-G1V63.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-V8GHN.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-LIHCA.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-U6TG2.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-Q0ISE.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\vulfixlocalconfig.ini
Deletes the following files:
- %TEMP%\is-B2FOE.tmp\<File name>.tmp
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\kclearak.dat.d
Moves the following files:
- from %TEMP%\is-MIF4Q.tmp\kcleaner\is-0OTBQ.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\kcleaner.dll
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-TU0JH.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\61000061.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-4H8QI.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\61000057.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-I5SKE.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\61000056.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-OGLQL.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\61000039.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-V4UPH.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\60047637.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-NPF4C.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\60047501.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-9NKVP.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\60045166.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-RKOTH.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\60044347.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-2EI8A.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\60040408.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-4J3J4.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\60039769.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-V442H.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\60039558.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-L9SRF.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\60038242.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-IMS63.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\60005486.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-E8B83.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\60005485.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-JI2SU.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\60005482.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-VOO7O.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\60002917.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-GF5T5.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\60002916.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-UGCOG.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\60001814.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-63NJ7.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\60001467.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-A35JJ.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\61000067.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-E3D47.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\61000068.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-8T38F.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\61000071.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-6HCK1.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\61000078.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\security\kxescan\is-88F1I.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\security\kxescan\kxesansp.dll
- from %TEMP%\is-MIF4Q.tmp\kcleaner\security\kxescan\is-KT6PP.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\security\kxescan\ksreng3.dll
- from %TEMP%\is-MIF4Q.tmp\kcleaner\security\kxescan\is-T0D5F.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\security\kxescan\config3a.dat
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-C7M42.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\91000004.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-DCRM7.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\91000003.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-6OJ03.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\91000002.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-OR79N.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\91000001.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-N87ON.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\81000003.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-EOH25.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\81000002.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-KQ5NT.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\61000128.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-5N17T.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\81000001.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-KEPOU.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\61000095.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-T5PJJ.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\61000094.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-CJUQC.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\61000093.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-M5SO6.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\61000092.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-6FL00.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\61000091.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-PPRSQ.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\61000090.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-18UKQ.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\61000089.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-9P1MS.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\61000088.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-5O8T4.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\61000087.png
- from %APPDATA%\kingsoft\is-2J8JN.tmp to %APPDATA%\kingsoft\netpayplog.ini
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-T549J.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\60000404.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-B0IRN.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\60000399.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-ESQDJ.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\60000234.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-BN5RP.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\deepignorelist.dat
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-253M3.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\competing_pop_cloud_cfg.ini
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-DNBNH.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\cleanlist.dat
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-I62F9.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\bootoptcfg.ini
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-8D9KS.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\bdmisc.dat
- from %TEMP%\is-MIF4Q.tmp\kcleaner\is-T9RTR.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\zlib1.dll
- from %TEMP%\is-MIF4Q.tmp\kcleaner\is-2LCS3.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\msvcr80.dll
- from %TEMP%\is-MIF4Q.tmp\kcleaner\is-PKATJ.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\msvcp80.dll
- from %TEMP%\is-MIF4Q.tmp\kcleaner\is-GVJCB.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\microsoft.vc80.mfc.manifest
- from %TEMP%\is-MIF4Q.tmp\kcleaner\is-6R21H.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\microsoft.vc80.crt.manifest
- from %TEMP%\is-MIF4Q.tmp\kcleaner\is-CHB31.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\kxetray.exe
- from %TEMP%\is-MIF4Q.tmp\kcleaner\is-P2NLQ.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\ktrashscanex.dll
- from %TEMP%\is-MIF4Q.tmp\kcleaner\is-HA2IE.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\ktrashscan.dll
- from %TEMP%\is-MIF4Q.tmp\kcleaner\is-OT0SJ.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\kskinmgr.dll
- from %TEMP%\is-MIF4Q.tmp\kcleaner\is-3U5RM.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\kscan.exe
- from %TEMP%\is-MIF4Q.tmp\kcleaner\is-USTBI.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\kismain.exe
- from %TEMP%\is-MIF4Q.tmp\kcleaner\is-SF3LP.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\kismain.dll
- from %TEMP%\is-MIF4Q.tmp\kcleaner\is-M4DT2.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\kclearpanel.dll
- from %TEMP%\is-MIF4Q.tmp\kcleaner\is-LN75V.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\kcleaner.exe
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-HJG94.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\floatwinsetting.ini
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-15SD2.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\kaccclear.dat
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-N2P70.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\kcleanerselectallrisk.xml
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-N6I7S.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\kclearak.dat
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-RFMS9.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\60000116.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-3VIK2.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\60000057.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-13S4M.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\60000047.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-SJ8OE.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\60000043.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-RSSF2.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\60000030.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-Q0ISE.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\60000002.png
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\clearplugin\is-ONPEU.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\clearplugin\plugin.nlb
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\clearplugin\is-JT53T.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\clearplugin\plugin.dat
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\clearplugin\is-JGI55.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\clearplugin\ksreng3.dll
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-GR3HL.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\vulfixlocalconfig.ini
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\calendar\is-UTHF1.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\calendar\kcalendarsetting.ini
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-5HR48.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\trashign.dat
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-4EVLQ.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\ticket_cfg.ini
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-5SEA6.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\strash.dat
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-G1V63.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon.dat
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-V8GHN.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\rcmdlocal.dat
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-LIHCA.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\popdata.ini
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-U6TG2.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\kxesetting.dat
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-5GEPF.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\ksofticondownloader.dat
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\is-H148J.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\komsadd.dat
- from %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\is-1VNDK.tmp to %TEMP%\is-MIF4Q.tmp\kcleaner\data\softicon\softicon48\60000118.png
- from %APPDATA%\kingsoft\is-LP26R.tmp to %APPDATA%\kingsoft\netpayprotect.ini
Substitutes the following files:
- %TEMP%\is-MIF4Q.tmp\kcleaner\data\kclearak.dat.d
Network activity:
Connects to:
- 'dl.##inshan.com':80
TCP:
HTTP GET requests:
- http://dl.##inshan.com/duba/config/ticket_cfg.ini
- http://dl.##inshan.com/duba/config/competing_pop_cloud_cfg.ini
UDP:
- DNS ASK dl.##inshan.com
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'kxetray{DF737DA7-CDCC-4e53-BE4F-96706694ED9F}'
Creates and executes the following:
- '%TEMP%\is-B2FOE.tmp\<File name>.tmp' /SL5="$30092,8011165,68608,<Full path to file>"
- '<Full path to file>' /VerySilent
- '%TEMP%\is-GBHIO.tmp\<File name>.tmp' /SL5="$50036,8011165,68608,<Full path to file>" /VerySilent
- '%TEMP%\is-MIF4Q.tmp\kcleaner\kcleaner.exe'
- '%TEMP%\is-MIF4Q.tmp\kcleaner\kxetray.exe'
- '%TEMP%\is-MIF4Q.tmp\kcleaner\kismain.exe' /lite_trash
- '%TEMP%\is-MIF4Q.tmp\kcleaner\kxetray.exe' /kismain /lite_trash
